fix(swarm): Remove build directives and unsupported options for swarm

Docker Swarm doesn't support build directives or security_opt.
Images must be pre-built before deployment.

Changes:
- Created build-images.sh script to build all images
- Updated deploy-swarm.sh to check for images and offer to build
- Removed build: sections from docker-compose.swarm.yml
- Removed security_opt: (not supported in swarm)
- Services now reference pre-built images only

Deployment workflow:
1. ./build-images.sh (build all images)
2. ./deploy-swarm.sh mosaic (deploy to swarm)

build-images.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+set -euo pipefail
+
+# Mosaic Stack - Build Images for Swarm Deployment
+# This script builds all Docker images needed for the stack
+
+echo "🔨 Building Mosaic Stack images for swarm deployment..."
+echo ""
+
+# Build postgres with pgvector
+echo "📦 Building postgres..."
+docker build -t mosaic-stack-postgres:latest -f docker/postgres/Dockerfile docker/postgres/
+
+# Build openbao
+echo "📦 Building openbao..."
+docker build -t mosaic-stack-openbao:latest -f docker/openbao/Dockerfile docker/openbao/
+
+# Build API
+echo "📦 Building API..."
+docker build -t mosaic-stack-api:latest -f apps/api/Dockerfile . --build-arg NODE_ENV=production
+
+# Build orchestrator
+echo "📦 Building orchestrator..."
+docker build -t mosaic-stack-orchestrator:latest -f apps/orchestrator/Dockerfile .
+
+# Build web (using NEXT_PUBLIC_API_URL from .env if available)
+echo "📦 Building web..."
+if [ -f .env ]; then
+    NEXT_PUBLIC_API_URL=$(grep "^NEXT_PUBLIC_API_URL=" .env | cut -d= -f2 || echo "https://api.mosaicstack.dev")
+else
+    NEXT_PUBLIC_API_URL="https://api.mosaicstack.dev"
+fi
+docker build -t mosaic-stack-web:latest -f apps/web/Dockerfile . --build-arg NEXT_PUBLIC_API_URL="$NEXT_PUBLIC_API_URL"
+
+echo ""
+echo "✅ All images built successfully!"
+echo ""
+echo "Built images:"
+docker images | grep mosaic-stack
+
+echo ""
+echo "Next step:"
+echo "  Deploy to swarm: ./deploy-swarm.sh mosaic"